ES3015091T3 - System, method and computer programs for user authentication and/or authorization - Google Patents

Abstract

The system includes a passive card (10) configured to store a first portion of an authentication or authorization code using an array of capacitive dots (11) on its surface; and a portable computing device (20) with a capacitive screen, configured to store a second portion of said code. In this way, once the user (1) has requested access to a specific service or operation, and when the passive card (10) is in contact with the capacitive screen, the portable computing device (20) is configured to read at least a portion of the array of capacitive dots (11), decode the first portion, and cryptographically sign the decoded first portion using said stored second portion, thereby providing the authentication or authorization code, which is used as a cryptographic key to grant the user (1) access to said service or operation. (Automatic translation with Google Translate, no legal value)

Description

DESCRIPTION

System, method and computer programs for user authentication and/or authorization

Field of the invention

The present invention relates to user authentication and/or authorization systems and methods. In particular, the present invention proposes a passive card with capacitive dots on its surface and a portable computing device for use in authentication and/or authorization solutions.

Background of the invention

Users constantly access services and resources from mobile and portable computing devices. Authentication of accessing users is vitally important to protect access to services, resources, and sensitive data, and to limit access to authorized users only.

The need to identify users who consume different types of services is closely related to preventing identity theft, but privacy security must also be considered. Therefore, it is of utmost importance to determine whether users are who they claim to be, but it is equally important to maintain the confidentiality of the information exchanged in this process.

The user identification process typically relies on certain credentials, the ownership and verification of which guarantee the user's identity. The credentials used are typically issued by a trusted authority and are theoretically impossible (or at least extremely difficult) to forge, making it possible to determine whether users are who they claim to be.

The user identification process is built on so-called validation or authentication mechanisms. These mechanisms are designed to validate certain information that the user provides to access the requested (digital) services. The information carried (which the user provides to the authentication mechanism for validation) typically falls into one of the following categories: something the user knows (e.g., a secret keyword), something the user possesses (e.g., a physical object also called a physical token, such as a smart card, SIM card, NFC tag, etc.), something the user owns (e.g., any measurable physical characteristic that uniquely identifies the user, such as fingerprints or iris identification), something the user does (e.g., movement patterns, signature, etc.), or a location where the user is (e.g., being in a specific location). This information is known as an identifier or digital credential. Sometimes a combination of information belonging to different categories is used to enhance security.

The effectiveness of any authentication solution cannot be measured solely in terms of security—because many of them are equivalent in that regard—but rather by also considering usability, ease of implementation, and cost and energy consumption. Only by considering all of these aspects simultaneously is it possible to achieve widespread user adoption of the authentication solution.

One of the main flaws of current authentication solutions is that user credentials (password, event token or fingerprint, etc.) are subject to copying, shoulder snooping, or theft by malicious outside observers, who can then access the target service/asset by falsifying their identity as that of an authorized user.

Tam Vu et al., "Capacitive Touch Communication: A Technique to Input Data through Devices' Touchscreen," describes a method for identifying and authenticating users on touchscreen devices, based on wearable devices that actively generate an input, which will be detected by the capacitive screen and decoded as a binary sequence. The described solution uses an active device (ring, watch, etc.) as a low-power continuous transmitter, to provide users with (continuous) authentication. In contrast, the present invention uses a passive device (card) to authenticate the end user.

Mohamed Azard Rilvan et al., "User Authentication and Identification on Smartphones by Incorporating Capacitive Touchscreen," leverages a snapshot taken by a capacitive screen, of four fingers, an ear, or a thumb, and uses it as a key for one-time authentication to access specific services or resources on the device itself. The described solution relies on measurements of human body characteristics, which are not 100% reliable by nature (and by the authors' claim). Furthermore, the described solution does not allow for multiple division of the readable area into sectors to provide multi-service authentication and/or random request of a specific sector for authentication, and/or encoding of other data and metadata.

The paper by Sun, Jingchao, et al., "Touchin: Sightless two-factor authentication on multi-touch mobile devices," describes a solution for identifying users on mobile devices based on a gesture executed on the touch interface of the mobile device itself. Gesture detection is independent of the screen area where it is executed, which prevents dirt analysis attacks and makes shoulder snooping more difficult. The described solution relies on an authentication factor (i.e., the touch gesture) that cannot be naturally translated into an encryption key, nor can it be divided into different sectors/areas to implement either multi-functional authentication or authentication based on random sector selection. Furthermore, the described solution features a non-zero set of visible elements, i.e., the signature, which is inherently subject to shoulder snooping.

Document US 9,652,066 describes a method for reading fingerprints across an entire capacitive display, also possible while performing other actions (touch, etc.). The fingerprint reading is then used as an authentication factor for the user, eventually on a continuous basis. The solution requires specific hardware on the end device (i.e., a fingerprint biometric detection layer). Furthermore, the described solution relies on measurements of human body characteristics. In this sense, the solution is not 100% reliable by nature and does not allow for splitting the readable area into multiple sectors to provide multi-service authentication and/or randomly requesting a specific sector for authentication.

Document EP-A1-2527955 is based on the detection of specific objects by mobile devices, using optical or capacitive sensing, to activate a predetermined state of the device (e.g., standby). Ultimately, this can also be used for authentication purposes, as indicated in the patent. The object identification proposed in this patent application aims to associate a common object with a desired state (e.g., charger with standby), but not to differentiate multiple instances of the same object, nor to encode a specific unique code into the object for authentication and/or encryption purposes.

Document WO-A1-2017143193 describes a method for identifying and authenticating users on touchscreen devices, based on wearable devices that actively generate an input, which will be detected by the capacitive screen and decoded as a binary sequence. This solution refers to the one also described in the article by Tam Vu et al., "Capacitive Touch Communication: A Technique to Input Data through Devices' Touchscreen." The method uses an active device - ring, watch, etc. - as a low-power continuous transmitter, to provide users with (continuous) authentication. In contrast, the present invention uses a passive device (card) to authenticate the end user.

Document US-A1-2016004407 relates to a user authentication system based on a card with a multi-touch surface touch. Also disclosed is a multi-touch capacitive surface that identifies the object and authenticates the user based on a gesture executed by the user using the card.

The described system is intended to authenticate a set of users carrying different instances of the same authentication card. The described solution may include a movement that the user must execute with the card on the capacitive surface, introducing restrictions on the screen size. In fact, the described solution is designed for authentication on fixed capacitive screens rather than on mobile devices with a limited capacitive surface, although a variant solution is also described for the use case of the capacitive surface of a mobile phone. Finally, there is no possibility of implementing multi-service authentication or multi-sector authentication by selecting a random sector/area in different authentication instances. Furthermore, this patent application does not include any possibility of using the contact pattern as part of an encryption code.

Document KR-A-2016036133A discloses a user authentication and transaction authorization system based on a rubber stamp applied to a capacitive screen of a mobile device and presenting a specific capacitive pattern, allowing the user to authenticate for a service and/or authorize specific operations. This solution does not decode the sequence of capacitive dots to give a code, as such, nor does it involve the device in the authentication and authorization process. In the present invention, furthermore, the code decoded from the series of capacitive dots is concatenated with a code on the device to form a unique key, which is used for authentication and authorization purposes, but can also be used to encrypt communication with the service server. Finally, this solution does not include multiple capacitive zones to be used for randomization purposes or to authenticate and authorize different services and operations.

WO-A1-2017024011 discloses a method comprising receiving an indication to launch an application on a mobile device, displaying a user interface, by the application, a request for a capture of a pattern on an item, receiving, by the application, a capture of patterns from the item, determining whether the pattern capture is complete, and sending the pattern capture to a first remote system for authenticating a transaction. Disclosed embodiments also include a card comprising first visible information about an account associated with the card, a machine-readable element comprising second information (which may have information in common with the first information), and a pattern comprising at least one mark including at least one of invisible ink or capacitive ink, which does not include the first information or the second information.

Document US-A1-2016004407 discloses a system for user authentication, particularly suitable for authenticating groups of users in hospital environments. The system comprises an authentication object provided with a redefined geometric pattern for authenticating the user. The system further comprises a multi-touch surface provided with a primary layer and a secondary layer. The multi-touch surface is configured to generate, in response to the predefined geometric pattern contacting the primary layer, a corresponding pattern of electrical interaction between the primary and secondary layers, allowing singular authentication based on said electrical interaction pattern.

Document WO-A1-2009009788 discloses that security tokens contain data that is each uniquely encrypted based on a unique biometric identifier of an authorized user of that token. Decoders receive the token and the user's biometric identifier, convert the biometric identifier into a biometric key, and apply the biometric key to decrypt the token. In this manner, the decoders authenticate users without performing a biometric identifier comparison. In some embodiments, pieces or sets of data are stored in designated data compartments, which are individually encrypted based on authority keys, and all encrypted data compartments are collectively encrypted based on the biometric key to create the token. The decoders store only the authority keys corresponding to the data compartments they are authorized to open. Furthermore, in some embodiments, the token and the biometric identifier are encrypted and sent to a remote authentication server for decryption of the token.

Known solutions still lack high reliability, availability, and ease of use. Therefore, more solutions for user authentication and/or authorization are needed.

Description of the invention

Embodiments of the present invention provide, according to a first aspect, a system for user authentication and/or authorization, comprising a passive card for storing a first portion of an authentication or authorization code via a set of capacitive points included on its surface; and a portable computing device having a capacitive display and configured to store a second portion of said authentication or authorization code.

In the proposed system, once the user has requested access to a specific service or a specific operation and when the passive card is in contact with the capacitive screen, the portable computing device is configured to read at least part of the set of capacitive dots, decoding the first portion of the authentication or authorization code, and to cryptographically sign the decoded first portion using said stored second portion of the authentication or authorization code, providing the authentication or authorization code, which is used as a cryptographic key to grant access to said requested specific service or specific operation requested to the user. Therefore, the proposed system represents a highly reliable authorization and/or authentication solution, while being usable, easy to implement, simple, cheap and with minimum power consumption.

Preferably, the array of capacitive points is invisible to human inspection.

According to the proposed system, some of the capacitive points may include information about the user or metadata about the card issuer. The information or metadata is preferably encoded with a different encoding system than the encoding system used to encode the first portion of the authentication or authorization code. The set of capacitive points includes at least two capacitive points located on predefined portions of the passive card.

In one embodiment, the surface of the passive card is divided into different logical areas/sectors, each area/sector comprising a set of capacitive points encoding a different first portion of the authentication or authorization code such that each different first portion can be used to authenticate a different service or to authorize a different operation.

The portable computing device may include a mobile phone, a laptop computer, or a tablet computer, among others. In one embodiment, the second portion of the authentication or authorization code is stored in a subscriber identification module (SIM) of the portable computing device. Alternatively, in another embodiment, the second portion is stored in a memory of the portable computing device with restricted access.

Embodiments of the present invention also provide, according to a second aspect, a method for authenticating and/or authorizing a user. The method comprises storing a first portion of an authentication or authorization code via an array of capacitive dots included on a surface of a passive card; storing a second portion of the authentication or authorization code on a portable computing device having a capacitive display; once the user has requested access to a specific service or a specific operation and when the passive card is in contact with the capacitive display, reading, by the portable computing device, at least some of the array of capacitive dots, decoding the first portion of the authentication or authorization code; and cryptographically signing, by the portable computing device, the decoded first portion using the stored second portion of the authentication or authorization code, providing the authentication or authorization code, which is used as a cryptographic key for granting access to said specific service or said specific operation to the user.

According to the proposed invention, the first portion of the authentication or authorization code depends on the shape, size and/or position of the set of capacitive points on the passive card.

In one embodiment, the reading is performed while the passive card is in contact with the capacitive display in a specific position, for example, a horizontal position or a vertical position of the passive card. Alternatively, the reading is performed while the passive card has undergone a specific movement, for example, a rotation or swipe of the passive card. The specific position or specific movement may be characteristic of a particular service or operation requested by the user.

In yet another embodiment, the storage of the second portion of the authentication or authorization code in the portable computing device occurs after the passive card is issued to the user. In this case, the second portion may be stored on the portable computing device's SIM or in a memory therein with restricted access. In the event of loss or theft of the passive card, it may be blocked (temporarily or permanently) or replaced via a secure channel.

Other embodiments of the invention disclosed herein include software programs for performing the steps of performing the method and operations summarized above and disclosed in detail below. More particularly, a computer program product is an embodiment having a computer-readable medium including computer program instructions encoded therein that when executed on at least one processor in a computer system cause the processor to perform the operations indicated herein as embodiments of the invention.

The present invention has the following unique advantages:

• It does not require specific hardware to operate, but relies on hardware available in any current handheld computing device (i.e., a capacitive input area).

• It does not require precision from the user in terms of the gesture executed, since the passive card presents reference points for the reader, making the process more user-friendly.

• It guarantees, in fact, a double authentication factor, because the system is composed of two unique components, namely the passive card and the portable computing device, each of which can only function in correspondence with the other.

• It doesn't require an active device, but rather a passive card the size of a common credit card, easy to carry and inexpensive to produce. Furthermore, the system is robust against partial card damage, thanks to multi-sector surface division.

• It is robust to attacks because the code is not visible on the card (shoulder snooping, skimming, distant photographs), physical contact is required to read (and eventually copy) the card - unlike NFC, the authentication key is partially stored on the passive card and partially stored on the computing device, making it ineffective to use the card on a different computing device (theft), the key is encoded on a specific portion of the card, unknown to the attacker, and the authentication process may rely on a different, unpredictable, and randomly generated code each time (Trojan viruses, hacker attacks, or phishing services). It is therefore resistant to brute-force attacks at least 1/n of the time, where "n" is the number of possible codes.

• It is easy and quick to use, because the user only has to place the card on the capacitive surface of the computing device, without requiring card centering or specific card placement.

• It can be used to authenticate for different services or to authorize a different class of operations, thanks to the surface division into multiple sectors.

• It can be used not only as a token for identification and authentication, but a specific portion of the capacitive points can be used to encode information about the user (such as an OpenID), or metadata about the system and the card issuer, among other possibilities. This information will be encoded using a different—open—coding system so that its decoding is available for any use.

Brief description of the drawings

The above advantages and features, as well as others, will be more fully understood from the following detailed description of embodiments, with reference to the attached drawings, which should be considered in an illustrative and non-limiting manner, in which:

Figure 1 illustrates an example of the capacitive points included in the passive card and a possible division into areas/sectors.

Figure 2 is a flowchart of an example authentication process.

Detailed description of preferred embodiments

The present invention proposes a user authentication and/or authorization system and method. The proposed solution takes advantage of the presence of a capacitive input area on portable computing devices 20, such as a special passive card reader 10, which includes a set of capacitive points 11 on its surface (see Figure 1). The capacitive points 11 result in pressure on the capacitive area, generating a specific and unique input.

The capacitive points 11 are easy and cheap to implement on a common plastic card (a passive device), while being invisible to human inspection, making the solution robust against snooping over the shoulder, distant photographs or scanning, and the card surface remains available for any printing (branding, advertising, etc.). Furthermore, the card reading is executed by means of a capacitive surface that is currently present in any portable computing device 20 (e.g., smartphone, tablet, laptop, etc. having a touch screen or touchpad), not requiring any additional or specific hardware, unlike other solutions based on NFC technology or fingerprint reading.

The card may include a pair of (or more) specific capacitive dots located at pre-established points on the card, for example, located at two opposite corners, at three different corners as in OR codes in the case of including three capacitive dots, etc., to make it easy to eliminate any measurement offset from the input reading and make card reading easier (i.e., not having to center the card with respect to any mark, or place it in a specific position). If the card only includes two capacitive dots, these will have a non-symmetrical shape and will be singular in the pattern.

Preferably, the size, shape or position of the capacitive points 11, or a combination of at least two of these characteristics (depending on the quality or quantity of the information to be encoded) is used to encode a unique sequence (or first portion of an authentication or authorization code). The number of possible sequences is high enough to guarantee uniqueness between different cards created. The unique sequence is then cryptographically signed using as a key another unique sequence (or second portion of the authentication or authorization code) stored in the portable computing device 20 and preferably obtained at the time of installation of a specific software application to be used to perform the reading of the passive card 10, representing a unique pairing with the unique sequence (or first portion) encoded in the passive card 10. The sequence obtained from the concatenation represents the authentication or authorization code that can be used as a cryptographic key to access the required service and/or authorize the required operation. The portion of the code stored on the portable computing device 20 may be located on the SIM card or other restricted access memory portions, such as the security elements (SE) found on some smartphones.

The presence of two different code portions (first portion and second portion or card code portion and device code portion as it may also be called), located on two different physical devices (i.e. the portable computing device 20 and the passive card 10) make the system robust against theft, because the theft of only one of the two elements does not allow any access/authorization, while the absence of the devices will be easily perceived, and the access devices can be blocked remotely by the user himself through an appropriate software procedure.

As can be seen in the embodiment of Figure 1, the surface of the passive card 10 can be divided into different logical areas or sectors 12, each comprising a set of capacitive points that encode a singular sequence (or a different first portion of an authentication or authorization code).

The presence of different areas 12 on the passive card 10, corresponding to different coded sequences, allows the following additional functionalities for the system:

• Use different areas 12 to access different services (for example, bank No. 1, bank No. 2, another service, etc.) or to authorize a different class of transactions.

• Ensure redundancy in case of partial damage to the passive card 10.

• Allows the code corresponding to a random sector (or sequence of sectors) to be required for different instances of authentication to the same service or authorization of a transaction. This is functionally equivalent to the current code cards distributed to bank customers for accessing online banking. This results in unpredictable, randomly assigned access coordinates and therefore prevents code theft through fake websites, Trojan viruses, or hacker attacks, making the transaction secure. This allows not only authentication but also authorization on the same card.

The position of the passive card 10 relative to the reading surface (e.g., horizontal/vertical, etc.) or a specific movement to be executed with the passive card 10 on the reading surface (e.g., rotation, swipe, etc.) may or may not be used as an additional authentication element for the system, based on something known to the user. For example, the system may be configured such that a horizontal position of the passive card 10 on the reading surface is for accessing a given service, while a swipe of the passive card 10 on the reading surface is for accessing a different given service.

Referring now to Figure 2, one embodiment of a user authentication and/or authorization method using the proposed system is illustrated. First, the passive card 10 is produced by encoding a specific code (the first portion of the authentication or authorization code) via the sequence of capacitive dots 11 printed on its surface. Then, the passive card 10 is given to the user 1, and a specific secret code (the second portion of the authentication or authorization code), associated with the passive card 10 as a unique pair, is stored in a trusted memory area on his or her portable computing device 20 (in this particular case, a smartphone), preferably when the software application for reading the passive card 10 is installed.

User 1 connects remotely to a server 30 requiring access to a specific service (e.g., electronic banking, access to restricted information, etc.) or authorization of a specific operation (e.g., money transfer, content publishing, etc.). This access may be performed either on the portable computing device 20 or on any other computing device, including stationary devices such as a PC.

Server 30 requires specific user authentication to proceed with the requested operation. Server 30 may include in this request the identification of a specific card area 12 or sequence of card areas, depending on the implementation.

If user 1 is accessing the service from a computing device other than the portable computing device 20, the computing device used connects to the portable computing device 20 using a secure connection and prompts the user to proceed with the authorization procedure. Otherwise, the portable computing device 20 proceeds directly with the authentication procedure. User 1 positions the passive card 10 on the capacitive surface of the portable computing device 20, either in a specific position or with a specific motion; depending on the implementation. The card input (sequence of capacitive points on its surface) is read by the portable computing device 20. The entire surface or a specific area(s) (or a specific sequence thereof) is decoded by the software application installed on the portable computing device 20. The resulting code is then cryptographically signed using as a key the unique code (second portion of the authentication or authorization code) stored on the portable computing device 20 to obtain a cryptographic key to be used by the portable computing device 20 to confirm the authentication to the server 30.

Finally, depending on the communication received, server 30 authenticates user 1/authorizes the operation, or not.

In the event of loss/theft of one of the two components 10, 20 of the described system, user 1 may request from the distributor, after a specifically required authentication:

• The (temporary) block of operations executed with your user (for example, loss of both items).

• Cancellation of the previously held passive card 10 and re-pairing of your portable computing device 20 with a new passive card 10, which will be provided through a secure channel (e.g., loss of the passive card 10).

• Cancellation of the previously held code for the portable computing device 20 and re-pairing its passive card 10 with a new portable computing device 20 (e.g., loss of the portable computing device 20).

In one embodiment, as an additional feature, a specific portion of the capacitive points 11 may be used to encode some other kind of information, including metadata about the vendor or the system itself, or some open information about the user 1, serving as an OpenID or as an additional level of validation. This information would be encoded using a different encoding system, because it may be available for open decoding.

The methods and systems discussed above are examples. Various configurations may omit, substitute, or add various method steps or procedures, or system components as appropriate. For example, in alternative configurations, the methods may be performed in a different order than described, and/or various phases, steps, or modules may be added, omitted, and/or combined. Likewise, features described with respect to certain configurations may be combined in various other configurations. Different aspects and elements of the configurations may be combined in a similar manner. Furthermore, technology evolves, and therefore, many of the elements are examples and do not limit the scope of the disclosure or claims.

Specific details are provided in the description to provide a thorough understanding of example configurations (including implementations). However, the configurations can be implemented without these specific details. For example, well-known circuits, processes, algorithms, structures, and techniques have been shown without any unnecessary detail to avoid complicating the configurations. This description only provides example configurations and does not limit the scope, applicability, or configurations of the claims. Rather, the preceding description of the configurations will provide those skilled in the art with an enabling description for implementing the described techniques. Various changes in the function and arrangement of elements may be made without departing from the spirit of the disclosure.

In addition, examples of the methods may be implemented in hardware, software, firmware, middleware, microcode, hardware description languages, or any combination thereof. When implemented in software, firmware, middleware, or microcode, the program code or code segments for performing the necessary tasks may be stored on a non-transitory, computer-readable medium such as a storage medium. Processors may perform the described tasks.

Furthermore, the exemplary embodiments described herein may be implemented as logical operations on a computing device in a networked computing system environment. The logical operations may be implemented as: (i) a sequence of computer-implemented instructions, steps, or program modules executing on a computing device; and (ii) interconnected logic or hardware modules executing within a computing device.

Although the subject matter has been described in language specific to structural features and/or methodological aspects, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or aspects described above. Rather, the specific features and aspects described above are disclosed as exemplary embodiments of the claims.

Claims (13)

1. A system for user authentication and/or authorization, comprising: a passive card (10) configured to store a first portion of an authentication or authorization code through a set of capacitive points (11) included on its surface; and a portable computing device (20) of a user (1) having a capacitive screen, characterized in that: - the portable computing device (20) is configured to store a second portion of said authentication or authorization code; and - the surface of the passive card (10) is divided into different logical areas (12), each area comprising a set of capacitive points encoding a different first portion, each first portion being different for authenticating a different service or for authorizing a different operation, such that, once the user (1) has requested access to a specific service or a specific operation and when the passive card (10) is in contact with the capacitive screen, the portable computing device (20) is additionally configured to read at least part of the set of capacitive points (11), decoding the first portion of the authentication or authorization code, and cryptographically signing the decoded first portion using as a key said stored second portion of the authentication or authorization code, obtaining the authentication or authorization code, which is used as a cryptographic key to grant access to said specific service or specific operation to the user (1). 2. The system of claim 1, wherein the array of capacitive points (11) is invisible to human inspection. 3. The system of claim 1 or 2, wherein some of the capacitive points of the set of capacitive points (11) include information about the user (1) or metadata about a card distributor, the information or metadata being encoded with an encoding system different from the encoding system used to store the first portion of the authentication or authorization code. 4. The system of any one of the previous claims, wherein the set of capacitive points (11) includes at least two capacitive points located in predefined parts of the passive card (10). 5. The system of claim 1, wherein the first portion of the authentication or authorization code depends on the shape, size and/or position of the set of capacitive points (11) on the passive card (10). 6. The system of claim 1, wherein the portable computing device (20) is a mobile phone, a laptop or a tablet and wherein the second portion of the authentication or authorization code is stored in a subscriber identification module, SIM, of the portable computing device (20) or in a memory thereof with restricted access. 7. A user authentication and/or authorization method, comprising: storing a first portion of an authentication or authorization code via a set of capacitive points (11) included on a surface of a passive card (10); storing a second portion of said authentication or authorization code on a portable computing device (20) of a user (1), the portable computing device (20) having a capacitive display; dividing the surface of the passive card (10) into different logical areas (12), each area comprising a set of capacitive points encoding a different first portion, each first portion being different for authenticating a different service or for authorizing a different class of operation; once the user (1) has requested access to a specific service or a specific operation and when the passive card (10) is in contact with said capacitive screen, reading, by the portable computing device (20), at least part of the set of capacitive points (11), decoding the first portion of the authentication or authorization code; and cryptographically signing, by the portable computing device (20), the first decoded portion using as a key the second stored portion of the authentication or authorization code, obtaining the authentication or authorization code, which is used as a cryptographic key to grant access to said specific service or specific operation to the user (1). 8. The method of claim 7, wherein some of the capacitive points of the set of capacitive points (11) include information about the user (1) or metadata about a card distributor, the information or metadata being encoded with an encoding system different from the encoding system used to store the first portion of the authentication or authorization code. 9. The method of any one of the previous claims 7 to 8, wherein the set of capacitive points (11) includes at least two capacitive points located in predefined parts of the passive card (10), and wherein the set of capacitive points (11) is invisible to human inspection. 10. The method of claim 7, wherein the first portion of the authentication or authorization code depends on the shape, size and/or position of the set of capacitive points (11) on the passive card (10). 11. The method of claim 7, wherein said reading is performed while the passive card (10) is in contact with said capacitive screen in a specific position, including a horizontal position or a vertical position of the passive card (10), or while the passive card has experienced a specific movement, including a rotation or a sliding of the passive card (10), and wherein the specific position or the specific movement is characteristic of the service or operation requested by the user (1). 12. The method of claim 7, wherein storing the second portion of the authentication or authorization code in the portable computing device (20) is performed after the passive card (10) is given to the user, wherein the second portion is stored in a subscriber identification module, SIM, of the portable computing device (20) or in a memory thereof with restricted access, and wherein in case of loss or theft of at least the passive card (10), the latter is blocked for a given period of time or replaced through a secure channel. 13. A computer program product comprising program code instructions that, when executed by a processor of a portable computing device, implement a method of user authentication and/or authorization by: dividing the surface of a passive card (10) into different logical areas (12), each area comprising a set of capacitive points (11) that encode a different first portion of an authentication or authorization code, each first portion being different for authenticating a different service or for authorizing a different class of operation; reading at least part of said set of capacitive points (11), said reading being carried out when the passive card (10) is in contact with a capacitive screen of the portable computing device (20) and once a user (1) has requested access to a specific service or a specific operation; as a result of said reading, decode the first portion; and cryptographically signing the first decoded portion using as a key a second portion of said authentication or authorization stored in the portable computing device (20), obtaining the authentication or authorization code, which is used as a cryptographic key to grant access to said specific service or specific operation to the user (1).